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Abstract. The dynamic establishment of shared information (e.g. se- 
cret key) between two entities is particularly important in networks with 
no pre-determined structure such as wireless sensor networks (and in 
general wireless mobile ad-hoc networks). In such networks, nodes es- 
tablish and terminate communication sessions dynamically with other 
nodes which may have never been encountered before, in order to some- 
how exchange information which will enable them to subsequently com- 
municate in a secure manner. In this paper we give and theoretically 
analyze a series of protocols that enables two entities that have never 
encountered each other before to establish a shared piece of information 
for use as a key in setting up a secure communication session with the 
aid of a shared key encryption algorithm. These protocols do not require 
previous pre-distribution of candidate keys or some other piece of infor- 
mation of specialized form except a small seed value, from which the two 
entities can produce arbitrarily long strings with many similarities. 



1 Introduction 

Wireless Sensor Networks (WSNs) have some constraints, with regard to 
battery life, processing, memory and commnication ([3]) capacity, and 
as such are deemed unsuitable for public crypto-based systems. Thus, 
symmetric key cryptosystems are more appropriate for these types of 
networks, but lead to problems with key distribution. These problems are 
mitigated with key pre-distribution schemes, in which candidate keys are 
distributed to members of the network before the start communication. 

Many innovative and intuitive key pre-distribution schemes for WSNs 
have been proposed for solving the problem of key distribution in sen- 
sor networks. On the two ends of the spectrum are key pre-distribution 
schemes that use a single master key as the encryption key distributed 
amongst all the nodes, and all pairwise keys, where a unique key exists 
for every pair of sensors. The former provides the most efficient usage 
of memory and scales well, but an attack on one node compromises the 
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whole network, whereas the latter provides excellent resilience but does 
not scale well. In addition, schemes exist which are in essence proba- 
bilistic, relying on the fact that any two neighbouring nodes have some 
probability p of successfully completing key establishment. Some such 
schemes are presented in the sequel, but the list is by no means exhaus- 
tive. The authors of [10] propose a key distribution scheme which con- 
sists of three phases. In the first phase, namely the key pre-distribution 
phase, k random keys are drawn from a generated pool of P keys, and are 
preloaded onto the sensor nodes before their deployment. These k keys 
constitute the key ring of each sensor node. The key identifiers of the key 
rings are loaded onto controller nodes, along with the identifiers of the 
corresponding nodes and the keys shared between the controller nodes 
and the sensor nodes. Once the nodes are deployed, the second phase 
takes place, the shared-key discovery phase, which allows nodes to dis- 
cover their neighbours within communication range and with which they 
share keys. This phase establishes the topology of the sensor network, 
as seen by the routing layer. The third, and final phase, is the path-key 
establishment phase which assigns a path-key to pairs of sensor nodes in 
wireless communication range that do not share a common key. The au- 
thors of [4] present an alternative to this scheme, the q-composite random 
key predistribution scheme, whereby instead of one single common key to 
be shared between two nodes, q keys are required, resulting in strength- 
ened securty under small scale attacks, trading off increased vulnerability 
on large scale attacks. The authors also propose the establishment of 
the key-path along multiple paths, and a random-pairwaise keys scheme 
which provides, amongst others, node-to-node authentication. The au- 
thors of [5] also take the scheme of [10] and modify it by taking into 
consideration that different locations of nodes require different security 
needs, and as such propose a subgrouping approach in order to isolate any 
node captures that might take place in specific subgroups. The scheme 
also provides scalability for key pre-distribution, by taking into account 
the probability of node compromise for each of the subgroups. Chan and 
Perrig ([6]) address the lack of scalability of existing symmetric-key key 
distribution protocols, and increase the security against node compro- 
mise. In their proposed PIKE protoccol, sensor nodes are used as trusted 
intermediaries to establish shared keys between nodes in the wireless sen- 
sor network. The authors of [8] propose a pair-wise key pre-distribution 
scheme, which is based on the scheme proposed by [1]. Their work in- 
volves the the pre-loading of crypto shares from multiple key spaces onto 
each sensor node, and after deployment, two nodes may establish a shared 
key between them only if they contain crypto shares from the same key 
space, leading to an improvement in scalability. Finally, the same au- 
thors ([9]) propose a scheme which utilises deployment knowledge, and 
generates pairwise keys between nodes and their neighbours, guarantee- 
ing that each node can establish a secure communications link with its 
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neighbours post deployment, with a high probability. The previous solu- 
tions all pre-suppose that the sensor nodes have been loaded with some 
pre-existing information (i.e. the key, or sets of keys) prior to network de- 
ployment, except for Liu and Cheng ([11]). They propose a self-configured 
scheme whereby no prior knowledge is loaded onto the sensor nodes, but 
shared keys are computed amongst the neighbours. The authors propose 
SBK which is also a topology adaptive scheme, achieves high connectivity 
with a small storage overhead, and iSBK, and improved version of SBK. 

In this paper, we propose a key agreement scheme whereby network 
nodes are not pre-loaded with candidate keys, but generate pairs of sym- 
metric keys from two, initially, random bits strings. The initial research 
conducted ([12]) proposed a protocol that involved the examination of 
random positions of subsets of size k, and the elimination of a random 
position if the two bit strings were found to disagree on more than half 
the examined positions. In that paper, however, the nodes cannot secretly 
compute the number of differing positions, a problem that is resolved 
in the present paper using secret circuit computations. In addition, the 
present protocols do not eliminate differing bits but flips them, depend- 
ing on the number of bit difference in the examined subset of k bits. This 
leads to a different stochastic process that called for a different theoret- 
ical analysis. The scheme we propose has the following four properties: 
(i) scalability, since new nodes may enter the network whenever they 
desire without the need to equip them with some suitable key set (ii) 
connectivity, since any two nodes of the network can reach a large degree 
of similarities on the strings the possess (iii) no storage overhead, since 
the string sizes are independent on the network size and (iv) resilience 
against node captures, since capturing any number of nodes of the net- 
work does not affect the strings other nodes possess. On the negative 
side, the protocol we give have some increased communication overhead. 
However, once two nodes reach a position where their two strings have 
sufficiently much similarity, they can create from them a large number of 
candidate keys (possibly using error correction techniques to create even 
more similarities) for their current and future communication needs. 

2 The bit-similarity problem 

Two entities, say and 1, initially possess an iV-bit string, X^j and Xj^ 
respectively. The entities' goal is to cooperatively transform their strings 
so as to increase the percentage of positions at which their strings contain 
the same bits, which we denote by X(i), with i being the time step of the 
protocol they execute. Then X(0) is the initial percentage of the positions 
at which the two strings are the same. 

Below we provide a randomized protocol in which the two entities 
examine randomly chosen subsets of their strings in order to see whether 
they differ in at least half of the places. If they do, one of the entities (in 
turn) randomly flips a subset of these positions. This process continues 
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up to a certain, predetermined number of steps. The intuition behind 
this protocol is that when two random substrings of two strings differ in 
at least half of their positions, then flipping some bits at random in one 
of the substrings is more likely to increase the percentage of similarities 
between the strings than to decrease it. In the description of the protocol 
-X^-fS] denotes a substring of string defined by the position set S. 

Protocol for user U c , c = 0, 1 

Protocol parameters known to both communicating parties: (i) k,l, the subset sizes, 
(ii) T, the number of protocol execution steps, (iii) the index (bit position) set N, (iv) 
The circuit C with which the two entities jointly compute whether there are at least 
\k/2] similarities between randomly chosen subsets of their strings. 

1. i <— 1 /* The step counter. */ 

2. while i < T /* T is a predetermined time step limit (discussed in Section 5).*/ 

3. begin /* while */ 

4. S <- JOINT_RAND(fc, {1, . . . , N}) /* Shared random set of k positions. See 
text. */ 

5. same_pos <— C(X^[S], X^ +1 mod 2 \S\) /* A secret computation of number of 
positions with same contents (see Section 3). */ 

6. if (same_pos > [~-|] and odd(i + c)) then /* Users and 1 alternate. */ 

7. begin 

8. SF <— RAND(2, S) /* Random set of I positions from within S to be flipped 
by the user whose turn it is to flip. */ 

9. flip the bits of X^[SF] 

10. end 

11. SYNCHRONIZE /* Users and 1 wait to reach this point simultaneously 
(barrier synchronization). */ 

12. i«-z + l 

13. end /* while */ 

An important requirement of the protocol is the existence of a random 
number generator at each party which produces the same values, started 
from a (small) seed value shared by both parties. This is in order to 
allow the two parties to avoid sending over the communication channel 
the chosen substring positions, as they are generated in synchrony by the 
two parties (see Line 4 of the protocol). 

With regard to the protocol, we are interested in the evolution of the 
random variable X(i), i.e. the percentage of the positions of X^ and Xj^ 
at which they are the same, after the ith step of the protocol. 

3 Secret two-party function computation 

During the execution of the protocol, it is necessary for the two commu- 
nicating parties to see whether they agree on at least half of the positions 
they have chosen to compare (line 13-14 of the protocol). Thus, the two 
parties need to perform a computation: compute the number of positions 
on which the corresponding bits in the two chosen subsets of k bits are 
the same. This is an instance of an important, general problem in cryp- 
tography: Secure Computation. 

Secure computation techniques allow two (or more) communicating 
parties to compute a function on their inputs so that nothing is revealed to 



4 



each party except what can be inferred from own input and the computed 
value. Moreover, no information is revealed about the bit values to a party 
not involved in the computation (e.g. eavesdropper). 

More formally, let A and B be two parties with inputs of tia and 
riB bits respectively. The objective is to jointly compute a function / : 
{0, 1} HA x {0, l} ns — > {0, 1} on their inputs. The issue, here, is that A 
and B cannot, simply, exchange their inputs and compute the function 
since they will learn each other's inputs, something that is not desirable 
in a secure computation setting. More importantly, even it A and B are 
willing to share their inputs, they would not allow an eavesdropper to 
acquire these inputs too. This leads to the problem of secure function 
computation. 

In our context, we consider the following two Boolean functions: 
f r : {0, \} k x {0, \} k -> {0, 1} with w A , wb G {0, l} k and < r < k : 

/( ^'^ ) = { 0, otherwise (1) 
We are interested in r = |"|] . 

fx : {0,l} k x {0,l} fe -» {0, l}nog 2 (fc)l with WAjWB G {0,l} fc : 
fx{wA,WB) = x, with x = X(wa,wb) written in binary. (2) 

The function fx is, strictly, an ordered tuple (f x , f x , . . . , f^ og2 ^ 1 ) of 
|~log 2 (£;)] 1-bit Boolean functions, where the function f l x computes the 
zth most significant bit of x = X(wa,wb) (with i = we take the most 
significant bit and with i = |~log 2 (A;)] — 1 we take the least significant 
bit). Using techniques from oblivious function computation (see [7] for a 
survey on these techniques) , we can prove that the computation of f r and 
fx can be done with randomized protocols using 0(\Cf r \) and 0(\Cf x \) 
communication steps respectively, with Cf T and Cf x being the Boolean 
circuits that are employed for the computation of / and fx respectively. 
Since both f r and fx are easily seen to be polynomial time computable 
Boolean functions, we can construct for their computations circuits of 
size polynomial in their input sizes, i.e. circuits Cf r and Cf x such that 
\Cf r \ = 0(k Cl ) and \Cf x \ = 0(k° 2 ), with constants ci,C2 > 0. Since k 
is considered a fixed constant, we conclude that we can compute fk and 
fx in a constant number of rounds. The number of random bits needed 
by each step of the randomized protocol is in both cases 0(k) and, thus, 
constant. 

To sum up, the functions f r and fx can, both, be evaluated on two 
fc-bit inputs wa, wb held by two parties A, B using a constant number of 
rounds and a constant number of uniformly random bits. In what follows, 
we will assume that the communicating parties use the function fvki • 

With regard to the required randomness, we assume that each of the 
two parties has a true randomness source, i.e. a source of uniformly ran- 
dom bits. Such a randomness source can be easily built into modern 
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devices. This randomness source is necessary in order to implement the 
randomized oblivious computation protocols for the computation of the 
function frki . In addition, it will be used in order to produce the ran- 



domly chosen positions, are required by Step 6 of the protocol. Since each 
position can range from 1 up to N (the string size), to form a position 
index we need to draw [~log 2 (iV)] random bits. Alternatively, if we allow 
the two parties to share a small (in relation to N) seed, they can produce 
the random positions in synchronization and, thus, avoid sending them 
over the communication channel. 

4 Theoretical analysis of the protocol 

In order to track the density of positions where two strings agree, we 
will make use of Wormald's theorem (see [13]) to model the probabilis- 
tic evolution of the protocol described in Section 2 using a deterministic 
function which stays provably close to the real evolution of the algorithm. 
The statement of the theorem is in the Appendix for completeness. What 
the theorem essentially states is that if we are confronted with a number 
of (possibly) interrelated random variables (associated with some random 
process) such that they satisfy a Lipschitz condition and their expected 
fluctuation at each time step is known, then the value of these variables 
can be approximated using the solution of a system of differential equa- 
tions. Furthermore, the system of differential equations results directly 
from the expressions for the expected fluctuation of the random variables 
describing the random process. 

We will first prove a general lemma that gives the probability of in- 
creasing the similarity between two strings through flipping, at random, 
the contents of a certain number of positions. 

Lemma 1. Let w±,W2 be two strings of Os and Is of length k. Let also j, 
< j < k, be the number of places in which the two strings differ. Then 
if I positions of one string are randomly flipped, the probability that s of 
them are differing positions is the following: 



Proof In Equation (3) the denominator is the number of all subsets of 
positions of cardinality I of the k string positions while the numerator is 
equal to the number of partitions of the I chosen positions such that s of 
them fall into the j differing positions and the remaining / — s fall into 
the remaining k — j non-differing positions of the two strings. Thus their 
ratio gives the desired probability. □ 
The following lemma, which is easy to prove based on general prop- 
erties of the binomial coefficients, provides a closed form expression for a 
sum that will appear later in some probability computations. 




(3) 
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Lemma 2. The following identity holds: 

J>-0^2|p=(^-l)z. (4) 

We will now derive the deterministic differential equation that governs 
the evolution of the random variable X(i) manipulated by the protocol 
in Section 2 using Wormald's theorem. 

Theorem 1. The differential equation that results from the application of 
Wormald's theorem on the quantity X(i) (places of agreement at protocol 
step i) as it evolves in the agreement protocol is the following: 



B[X(i + l) - X(i)} = 

k I 

£ ~ (* ~ S )) P k,j,l,s] P n,n-X(i),k,j- (5) 



Proof We will determine the possible values of the difference X(i + 1) — 
X(i) along with the probability of occurrence for each of them. 

The protocol described in Section 2 flips I positions within the k ex- 
amined positions, whenever these k positions contain j > |~|] differing 
positions in the two strings. From the flipped I positions, is s of them 
(0 < s < I) are disagreement positions, then the two strings will have 
gained s agreement positions, losing I — s. The net total is s — (I — s). The 
probability that this total occurs, for a specific value of s and a specific 
value of j is equal to Pk,j,i,sP n ,n-X(i),k,j- Summing up over all possible 
values of s,j we obtain (5). □ 

Corollary 1. The following holds : 



B[X(i + l)-X(i)} 

k 

= £ i\ ~- - i 

j=rfi 



2 1 

k 



(2) 



(6) 



Proof Equation (6) follows from (5) using Equation (3) of Lemma 1 with 
k = n,l = k,s=j,n — j = X(i), in conjunction with Lemma 2. 

Corollary 2. Using Wormald's Theorem (Theorem 3), the evolution of 
the random variable X{i) whose mean fluctuation is given in (6) can be 
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approximated by the following differential equation: 

dx(t) 
dt 

k 



Proof By applying the approximation 



£ l(^-l)Q[l-<t)Yx{tf-K (7) 



N\ N k ( n ( 1 
l + O 



/ A;! V 

of the binomial coefficients which is valid for k = 0(1) on the three 
binomials which appear on the the right-hand side of (6), we obtain the 
following: 

r? (i) )(£?) fk\ a i«v7^)\ H 



(2) vi 



n \ n 



Using Wormald's theorem, we make the correspondence x(t) = and 

= E[X(i + 1) — -X"(i)], which results in the required differential 
equation (7). □ 

5 Efficiency of the protocol 

From Equation (7) we see that the percentage of similar positions, rep- 
resented by the function x(t), is a monotone increasing function since its 
first derivative is always positive. In what follows, we will estimate how 
fast this percentage increases depending on its initial value x(0) as well 
as the parameters / and k. 

Lemma 3. The solution x(t) to the differential equation given in (7) is 
monotone increasing. 

Proof From the differential equation, we see that the first derivative of 
the function x(t), which is equal to the right-hand side of the differential 
equation, is strictly positive, since < x(t) < 1. Thus, the function x(t) 
is monotone increasing. □ 

Lemma 4. Let x(t\) be the value of the function x(t) at time instance t\ 
and xfo) be the value at time instance t2, t\ < £2- Let, also, c(ii) be the 
absolute value of the point at which the tangent line to the point (ti,x(ti)) 
of x(t\) cuts thet-axis and c(t2) the corresponding value for t^- Let, also, 



=r|i 
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Then 



Proof Let e\ and e 2 be the two tangent lines to the function x(t) at the 
points (ti,x(ti)) and (i 2 ,x(i 2 )) respectively, as shown in Figure 1. Due 
to the monotonicity of x(t), the points at which the two lines intersect 
with the t-axis are negative. Let c(t±) and c(i 2 ) be the absolute values 
of these two points for lines e\ and e 2 respectively. Then from the two 




Fig. 1. The two tangent lines for the proof of the Theorem 



right angle triangles that are formed we have tan(^i) = c ^y^ tl and 

tan(<^> 2 ) = c fo)+t2 ' From the definition of the derivative, tan(<^i) = ^^|tj 

and tan(0 2 ) = ^jp-\t 2 - From (7) and (8), we have = p(x(t)) and, 
thus, the statement of the lemma follows. □ 

Theorem 2. Let t! be the time instance at which x(t') = hx(0), with 
Kh< 4vr- Then 

- - x(0) 

t 2 < ,f^L ■ (h - 1). (10) 

Proof We set t\ = 0, i 2 = t' and x(t') = hx(0) in Lemma 4 and we obtain, 
from Equations (9) the following: 

P( x (°)) = -77W'P( hx (°)) = 



c(0)'^ y " c(t')+t> 
From these equations we obtain the following: 

p(s(0)) = c(t>) + t' 
p(hx(0)) ~ hc(0) 
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Solving for t' we obtain the following: 

hp(x(0))c(0) 
P(hx(0)) C[ty {U) 

Since p(x(0)) is the inclination of the tangent line to x(t) at the point 
(0,x(0)), it holds that p(x(0)) = Thus, (11) becomes 

1 ~ p(hx(0)) [ j ' [ ' 

Since x(t) is monotone increasing, the point at which the tangent to 
this function cuts the x(t)-axis at any point is greater than or equal to 
x(0) (see Figure 1). Let x c be this point. Then p{x{t')) = or, since 

x(t') = hx(0), p(hx(0)) = ^y. Since x c > x(0), c(f) > ^gyj. Thus, 
from (12), we obtain 

" p(fer(0)) p(/wr(0)) p(/kc(0)) 1 J 
which is the required. □ 

Lemma 5. T/ie following lower bounds hold for the polynomial in (8): 
If x < 1/2 then 

p(x)>l[x k + l-2x]. (13) 

Ifx > 1/2 tfien 

^^"-^(rii)^- (14) 

Proof In (8), allowing the sum index to cover all the range from 1 to A: 
reduces the value of the sum since it adds negative terms. Thus 

p(x)>/£(f -l) Qd 

Since the sum evaluates to l[x k + 1 — 2x] the first statement of the lemma 
follows. 

If, on the other hand, x > 1/2, then lower bound given for the first 
statement of the lemma is not good since it may even become negative. 
In this case we observe that the term (1 — x)^x k ~^ is minimized for j = k. 
Setting j = k in (8) we obtain the second statement of the lemma. □ 

Corollary 3. The following bounds hold for the time instance t' : 
lfhx(0) < 1/2 then 

t> < a(0)C»-l) (15 ) 

~ l[hx(0)) k + 1 - 2hx(0)}' { ' 
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Ifhx{0) > 1/2 then 



-([i-MO)]*( r |i)rll 

From (15) we see that the percentage of similarities grows fast, if we start 
from x(0) aiming at hx(0), with h > 1 and hx(0) < 1/2 (and (15) is 
only a very coarse upper bound). If the target is, however, at hx(0) with 
x > 1/2 the upper bound is not good as the denominator tends to fast. 
However, since this denominator is simply the first derivative of x(t) at 
hx{0), this derivative fast tends to if hx(0) > 1/2 and, thus, the tangent 
at this point tends to become parallel to the i-axis. Thus, we have again 
fast convergence. 



6 Conclusions 



In this paper we described a series of protocols that can be used in or- 
der to increase the percentage of similarities between two strings held by 
two communicating parties without revealing their values. The protocols 
involve the examination of random position subsets of size k and the flip- 
ping of a randomly chosen subset of these positions if the two strings 
are found to disagree in more than half the positions. In this way, the 
random process governing the protocol is directed towards flipping dis- 
agreement positions more than the flipping of agreement positions. The 
propose protocols are, in fact, general and may be used in any situa- 
tion involving either wireless or conventional networks in which there is 
no trusted third party or key management authority among the network 
nodes. 
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APPENDIX 

Approximating stochastic processes with deterministic 
functions: Wormald's Theorem [13] 

Definition 1. A function f satisfies a Lipschitz condition on D <zW if 
there exists some constant L > such that 

3 

|/0i, ...,Uj)- f(v 1: . . .,Vj)\ < L^2\v,i- Vi\ 

i=i 

for all (ui, . . . , Uj) and (v±, . . . , vj) in D. 

Definition 2. Given a random variable X depending on n, denoted by 
we say that l' n ' = o(/(n)) always if 

max{x|Pr[X (n) = x] + 0} = o(/(n)). 

Theorem 3. Let Y^ n \t), n > 1, be a sequence of real-valued random 
variables, 1 < i < k for some fixed k, such that for all i, all t and 
all n, \Y^ n \t)\ < Bn (n > 0) for some constant B. Let H(t) be the 
history of the sequence, i.e. the matrix (Y (0), . . . , Y (t)), where Y (t) = 
(Y} n \t),...,Y£ n \t)). 

Let L = {(yi, . . . ,y k ) : Pr[Y(0) = (y\n, . . .,y k n)} ^ for some n}. 
Let D be some bounded connected open set containing the intersection 
of {(s,yi,...,y k ) : s > 0} with a neighborhood of {(t/n,y 1 , . . . ,y k ) : 
(y±, . . . ,y k ) G /}. (That is, after taking a ball around the set L, D is 
required to contain the part of the ball in the half-space corresponding to 
s = t/n, s > 0.) 

Let fi : 3? fe+1 — > 3?, 1 < i < k, and suppose that for some m = m{n), 

(i) for all i and uniformly over all t < m, always 

E[yW(t + i)-yW(t)| H (t)] 

= f t (t/n,Y Q {n \t)/n, . . .,Y k {n \t)/n) + o(l), 

(ii) for all i and uniformly over all t < m, 

Pr[|y/ n) (t + 1) - Y t (n) {t)\ > n 1 / 5 ] = o(n- 3 ), always, 

(Hi) for each i, the function fi is continuous and satisfies a Lipschitz con- 
dition on D. 

Then 

(a) for (0, z(°\ . . . , z^) G D the system of differential equations 

dz,i 

-jj = fi(s, zq,..., z k ), 1 < i < k 

has a unique solution in D for ^ : — > 5ft passing through Zi(0) = 
zW,l < i < k, and which extends to points arbitrarily close to the 
boundary of D; 
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(b) almost surely (t) = Zi(t/n) ■ n + o(n), uniformly for < t < 
min{o", m} and for each i, where Zi(s) is the solution in (a) with = 
Y^ n \o)/n, and a = a(n) is the supremum of those s to which the 
solution can be extended. 
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